Optimized combined-clustering methods for finding replicated criminal websites

Abstract

To be successful, cybercriminals must figure out how to scale their scams. They duplicate content on new websites, often staying one step ahead of defenders that shut down past schemes. For some scams, such as phishing and counterfeit goods shops, the duplicated content remains nearly identical. In others, such as advanced-fee fraud and online Ponzi schemes, the criminal must alter content so that it appears different in order to evade detection by victims and law enforcement. Nevertheless, similarities often remain, in terms of the website structure or content, since making truly unique copies does not scale well. In this paper, we present a novel optimized combined clustering method that links together replicated scam websites, even when the criminal has taken steps to hide connections. We present automated methods to extract key website features, including rendered text, HTML structure, file structure, and screenshots. We describe a process to automatically identify the best combination of such attributes to most accurately cluster similar websites together. To demonstrate the method's applicability to cybercrime, we evaluate its performance against two collected datasets of scam websites: fake escrow services and high-yield investment programs (HYIPs). We show that our method more accurately groups similar websites together than those existing general-purpose consensus clustering methods.

Double-Constrained Consensus Clustering with Application to Online Anti-Counterfeiting

“…The use of clustering techniques to analyze the content and infrastructure of fraudulent websites has been recently investigated to combat other malicious online activities carried out across a variety of website categories. A few examples are as follows: acquisition of cryptocurrency funds from unsuspecting investors with the false promise of gaining more cryptocurrency or accessing a service [26], sale and delivery of fictitious pets through scam websites [27], monetization of parked domain names through hosting ads [28], distribution of exploit kits through malicious websites [29], fake escrow services and high-yield investment programs [30], video piracy [31], and phishing websites [32]. Analogous to anticounterfeiting, studies in these fields report that a limited number of entities are running multiple instances of similar scams.…”

“…All these studies were conducted using a particular clustering algorithm on a whole (domain-specific) set of features. One partial exception is [30], where a hierarchical agglomerative clustering algorithm was run on all possible combinations of individual features. However, this approach requires labeled training data to select the top-performing combination.…”

“…However, they reported limited success. Single or combined clustering algorithms have also been recently applied to finding networks of malicious websites in several other domains, leveraging similar or novel clustering features (e.g., [26][27][28][29][30][31]). Our work expands on previous research by integrating constraints and multiple clustering algorithms in the process of grouping fraudulent websites into connected networks and by showing how such constraints can be partly acquired automatically.…”

“…Various clustering features have been proposed for this or related tasks, usually associated with the structure ( [25,28,29,51]), content ([26,27,30,31]), and visual appearance of malicious websites ( [30,32]), or with information about their registration or network infrastructure ( [25,30,31]). We followed two main criteria to select the features for the experiments: that they were representative of main feature categories, and that they were present and easily acquirable for almost all web shops in CAP.…”